995 matches found
CVE-2024-6691: Improper Neutralization of Input During Web Page Generation
The Easy Digital Downloads – Sell Digital Files & Subscriptions eCommerce Store + Payments Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the currency value in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. Thi...
CVE-2024-6692
CVE-2024-6692 affects Easy Digital Downloads – eCommerce Payments and Subscriptions made easy (WordPress plugin) up to version 3.3.2. It allows Stored Cross-Site Scripting via the Agreement Text field, requiring authenticated administrator access, and impacts multi-site installations or sites whe...
CVE-2024-6691
CVE-2024-6691 affects the Easy Digital Downloads – Sell Digital Files & Subscriptions plugin for WordPress. It is a stored cross-site scripting (XSS) vulnerability in the currency setting, exploitable via authenticated admin access. Impact is limited to multisite installations and sites where unf...
CVE-2024-6691 Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Currency Settings
The Easy Digital Downloads – Sell Digital Files & Subscriptions eCommerce Store + Payments Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the currency value in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. Thi...
PT-2024-37802
Name of the Vulnerable Software and Affected Versions Easy Digital Downloads – Sell Digital Files & Subscriptions plugin for WordPress versions up to, and including, 3.3.2 Description The issue is related to Stored Cross-Site Scripting via the Agreement Text value due to insufficient input...
CVE-2024-7484: Unrestricted Upload of File with Dangerous Type
The CRM Perks Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'handleuploadedfiles' function in versions up to, and including, 1.1.3. This makes it possible for authenticated attackers with administrator-level capabilities or above, to...
CVE-2024-6520
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom error message in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes ...
CVE-2024-6521
CVE-2024-6521 affects the WordPress plugin Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder. All versions up to 5.1.19 are vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. Exploitation requires Administrator...
CVE-2024-6520: Improper Neutralization of Input During Web Page Generation
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom error message in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes ...
CVE-2024-6661: Improper Neutralization of Input During Web Page Generation
The ParityPress – Parity Pricing with Discount Rules plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Discount Text' in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...
CVE-2024-6518: Improper Neutralization of Input During Web Page Generation
The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via input fields in all versions up to, and including, 5.1.19 due to insufficient input sanitization and output escaping. This makes it...
CVE-2024-6705
CVE-2024-6705 affects the RegLevel WordPress plugin (versions up to and including 1.2.1) and enables Stored XSS via admin settings. Exploitation requires authenticated access at Administrator level or higher, and the issue specifically impacts multisite installations or sites where unfiltered_htm...
CVE-2024-6123
The Bit Form plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'iconUpload' function in all versions up to, and including, 2.13.3. This makes it possible for authenticated attackers, with administrator-level and above permissions, to upload...
CVE-2024-6123: Unrestricted Upload of File with Dangerous Type
The Bit Form plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'iconUpload' function in all versions up to, and including, 2.13.3. This makes it possible for authenticated attackers, with administrator-level and above permissions, to upload...
CVE-2024-6011
The Cost Calculator Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘textarea.description’ parameter in all versions up to, and including, 3.2.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2024-6011: Improper Neutralization of Input During Web Page Generation
The Cost Calculator Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘textarea.description’ parameter in all versions up to, and including, 3.2.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
PT-2024-37465
Name of the Vulnerable Software and Affected Versions: The Booking for Appointments and Events Calendar – Amelia plugin for WordPress versions 1.1.5 and earlier The Booking for Appointments and Events Calendar – Amelia plugin for WordPress Pro version 7.5.1 and earlier Description: The issue is...
MelaPress Login Security < 1.3.1 - Authenticated (Admin+) Remote File Inclusion
Description The MelaPress Login Security plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 1.3.0 via the 'tab' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary...
